Cisco Systems CL-28826-01 AAA Firewall Page, MAC-Exempt List Tab

15-23

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter15 Managing Firewall AAA Rules

AAA Firewall Settings Policies

AAA Firewall Page, MAC-Exempt List Tab

Use the MAC Exempt List tab of the AAA Firewall settings policy to identify hosts that should be

exempt from authentication and authorization for ASA, PIX, and FWSM 3.x+ devices. For example, if

the security appliance authenticates TCP traffic originating on a particular network but you want to allow

unauthenticated TCP connections from a specific server, create a rule permitting traffic from the MAC

address of the server.

You can use masks to create rules for groups of MAC addresses. For example, if you want to exempt all

Cisco IP phones whose MAC addresses start with 0003.e3, create a permit rule for 0003.e300.0000 with

the mask ffff.ff00.0000. (An f in a mask exactly matches the corresponding number in the address,

whereas a 0 matches anything.)

Deny rules are necessary only if you are permitting a group of MAC addresses but there are some

addresses within the permitted group that you want to require to use authentication and authorization.

Deny rules do not prohibit traffic; they simply require the host to go through normal authentication and

authorization. For example, if you want to allow all hosts with MAC addresses that start with 00a0.c95d,

but you want to force 00a0.c95d.0282 to use authentication and authorization, enter these rules in order:

1. Deny 00a0 .c95d.0282 ffff. ffff.ffff

2. Permit 00a0.c95d.0000 ffff.ffff.0000

When you deploy the policy to the device, these entries are configured using the mac-list and aaa

mac-exempt commands.

Tip The MAC exempt list is processed on a first match basis. Thus, the order of entries matters. If you want

to permit a group of MAC addresses, but deny a subset of them, the deny rule must come before the

permit rule. However, Security Manager does not allow you to order MAC exempt rules: they are

implemented in the order shown. If you sort the table, your policy changes. If your entries do not depend

on each other, this does not matter. Otherwise, ensure that you enter rows in the proper order.

Navigation Path

To access the MAC Exempt List tab, do one of the following:

•(Device view) Select an ASA, PIX, or FWSM device, then select Firewall > Settings > AAA

Firewall. Select the MAC-Exempt List tab.

•(Policy view) Select Firewall > Settings > AAA Firewall from the Policy Type selector. Create a

new policy or select an existing one, then select the MAC-Exempt List tab.

•(Map view) Right-click an ASA, PIX, or FWSM device and select Edit Firewall Settings > AAA

Firewall, then select the MAC-Exempt List tab.